Privacy Policy

1. Who we are

ArthaBase is a business operating from Indonesia that provides Bali villa market intelligence through arthabase.com and app.arthabase.com. For the personal data described in this policy, ArthaBase is the data controller. You can reach us at hello@arthabase.com.

2. Scope

This policy applies to personal data we collect across all pages of our websites and app. It does not apply to third-party sites you reach through links on our properties; those sites have their own privacy policies.

3. Personal data we collect

Data you give us. When you email us or purchase a report, we collect your email address and any details you choose to send us.

Data collected automatically. When you visit our properties we may collect technical and usage data such as IP address, approximate location, browser and device type, pages viewed, referring page, and interactions with the page. Most of this is collected through cookies and similar technologies and only with your consent (see Cookies below).

4. Why we use your data and our legal basis

Under the GDPR we rely on the following legal bases:

• Consent (Art. 6(1)(a)). Analytics and marketing cookies, and sending you marketing emails. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)). Operating, securing, and improving our properties, and responding to your enquiries, where this is not overridden by your rights.
• Legal obligation (Art. 6(1)(c)). Where we must keep or disclose data to comply with applicable law.

We do not sell your personal data.

5. Sharing and processors

We share personal data only with service providers ("processors") who help us run our properties on our instructions, for example analytics and product-experience measurement providers, hosting and infrastructure providers, and email and automation providers. These processors may only use the data to provide their service to us. We may also disclose data where required by law or to protect our rights, our users, or the public.

6. International data transfers

We operate from Indonesia and our processors are located in several countries, including Germany, the United States, and Singapore. This means your personal data may be transferred to and processed outside your country, including outside the European Economic Area (EEA). Where we transfer data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or transfers to countries recognised as providing adequate protection. You can ask us for more detail using the contact below.

7. Cookies and similar technologies

We use cookies and similar technologies to run our properties, to remember your cookie choices, and (only with your consent) to measure how the site is used and to support marketing. When you first visit, our cookie banner lets you accept all cookies or open Manage preferences to choose by category. You can change your choice at any time through the Cookie settings link in the footer.

Until you give consent, non-essential cookies stay off and Google tags run in a consent-denied mode. You can also control cookies through your browser settings.

8. Retention

We keep personal data only for as long as we need it for the purposes in this policy, or as required by law, after which we delete or anonymise it. Your cookie consent record is kept for up to 6 months. You can unsubscribe from marketing emails at any time using the link in each message.

9. Your rights

Subject to applicable law, you have the right to access your personal data, to rectify or erase it, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these rights, email hello@arthabase.com and we will respond within the time required by law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

10. Security

We take reasonable technical and organisational measures to protect personal data. No online system is completely secure, so we cannot guarantee absolute security.

11. Children

Our services are not directed at children. We do not knowingly collect personal data from anyone under 18.

12. Changes

We may update this policy from time to time. The current version will always be on this page with an updated effective date.

13. Contact

Questions about this policy, your personal data, or to exercise your rights: hello@arthabase.com